From 2c761f208dd512191669d66951b0979c67364d83 Mon Sep 17 00:00:00 2001 From: John Pruitt Date: Wed, 5 Aug 2026 16:21:37 -0500 Subject: [PATCH 1/2] fix(ci): restore workflow read permission --- .github/workflows/me-import.yml | 22 +++++++++++++--------- packages/cli/commands/project-ci.test.ts | 1 + packages/cli/commands/project-ci.ts | 3 +++ 3 files changed, 17 insertions(+), 9 deletions(-) diff --git a/.github/workflows/me-import.yml b/.github/workflows/me-import.yml index bd11ca11..b9a5b05b 100644 --- a/.github/workflows/me-import.yml +++ b/.github/workflows/me-import.yml @@ -1,33 +1,37 @@ -# Managed by 'me ci install' — re-run it to update; remove this line to hand-maintain. name: Memory Engine import on: - push: # all branches — the job itself gates on the default branch - workflow_dispatch: {} # manual backfill / re-run + push: + workflow_dispatch: {} permissions: contents: read concurrency: group: me-import-${{ github.ref }} - cancel-in-progress: true # newest run on the same ref supersedes: every run is a full catch-up + cancel-in-progress: true jobs: import: - # Default branch only, discovered at runtime — survives a rename, and - # keeps this file identical across repos (no scaffold-time values). if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch) runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 with: - fetch-depth: 0 # REQUIRED — the git walk and docs git-date temporals need full history + fetch-depth: 0 - name: Install me run: | set -o pipefail mkdir -p "$HOME/.local/bin" curl -fsSL https://install.memory.build | ME_INSTALL_DIR="$HOME/.local/bin" sh - - name: Import + - name: Import git history env: ME_API_KEY: ${{ secrets.ME_API_KEY }} + ME_SPACE: ahkgk250pmzh run: | - "$HOME/.local/bin/me" import ci + "$HOME/.local/bin/me" import git --tree /share/projects/memory-engine + - name: Import docs + env: + ME_API_KEY: ${{ secrets.ME_API_KEY }} + ME_SPACE: ahkgk250pmzh + run: | + "$HOME/.local/bin/me" import docs . --git-aware --prune --tree /share/projects/memory-engine diff --git a/packages/cli/commands/project-ci.test.ts b/packages/cli/commands/project-ci.test.ts index d3310c6f..13befd3f 100644 --- a/packages/cli/commands/project-ci.test.ts +++ b/packages/cli/commands/project-ci.test.ts @@ -62,6 +62,7 @@ describe("me ci install", () => { expect(workflow).toContain("ME_API_KEY: ${{ secrets.ME_API_KEY }}"); expect(workflow).toContain("ME_SPACE: team-memory"); expect(workflow).toContain("ME_SERVER: https://me.example.test"); + expect(workflow).toContain("permissions:\n contents: read"); expect(workflow).toContain("import git --tree /share/projects/widgets"); expect(workflow).toContain( "import docs . --git-aware --prune --tree /share/projects/widgets", diff --git a/packages/cli/commands/project-ci.ts b/packages/cli/commands/project-ci.ts index aed21012..09a87813 100644 --- a/packages/cli/commands/project-ci.ts +++ b/packages/cli/commands/project-ci.ts @@ -67,6 +67,9 @@ on: push: workflow_dispatch: {} +permissions: + contents: read + concurrency: group: me-import-\${{ github.ref }} cancel-in-progress: true From 1d89461675d78f9e813fd7f7b0b6b267d9413a96 Mon Sep 17 00:00:00 2001 From: John Pruitt Date: Wed, 5 Aug 2026 16:24:42 -0500 Subject: [PATCH 2/2] fix(ci): avoid persisting checkout credentials --- .github/workflows/me-import.yml | 1 + packages/cli/commands/project-ci.test.ts | 1 + packages/cli/commands/project-ci.ts | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/workflows/me-import.yml b/.github/workflows/me-import.yml index b9a5b05b..7bb12947 100644 --- a/.github/workflows/me-import.yml +++ b/.github/workflows/me-import.yml @@ -18,6 +18,7 @@ jobs: - uses: actions/checkout@v6 with: fetch-depth: 0 + persist-credentials: false - name: Install me run: | set -o pipefail diff --git a/packages/cli/commands/project-ci.test.ts b/packages/cli/commands/project-ci.test.ts index 13befd3f..df366750 100644 --- a/packages/cli/commands/project-ci.test.ts +++ b/packages/cli/commands/project-ci.test.ts @@ -63,6 +63,7 @@ describe("me ci install", () => { expect(workflow).toContain("ME_SPACE: team-memory"); expect(workflow).toContain("ME_SERVER: https://me.example.test"); expect(workflow).toContain("permissions:\n contents: read"); + expect(workflow).toContain("persist-credentials: false"); expect(workflow).toContain("import git --tree /share/projects/widgets"); expect(workflow).toContain( "import docs . --git-aware --prune --tree /share/projects/widgets", diff --git a/packages/cli/commands/project-ci.ts b/packages/cli/commands/project-ci.ts index 09a87813..795f7f44 100644 --- a/packages/cli/commands/project-ci.ts +++ b/packages/cli/commands/project-ci.ts @@ -82,6 +82,7 @@ jobs: - uses: actions/checkout@v6 with: fetch-depth: 0 + persist-credentials: false - name: Install me run: | set -o pipefail